Privacy policy

SirTripsALot is a travel itinerary, expense and points tool. It exists to hold your bookings so you can read them in one place. This page says what it collects, why, who else sees it, and how to take it all back. It is written to be read, not agreed to.

What SirTripsALot holds about you

• Your account. The email address you sign in with, and, if you sign in with Apple or Google, the identifier they give us. We do not see your password with those; with a magic link there is no password at all.
• Your trips and bookings. Flights, stays, activities, confirmation codes, seats, the names of the travelers on a booking, prices and points, and anything you type into a booking or a debrief. These are the point of the app.
• Booking emails, if you connect a mailbox. With your permission SirTripsALot reads your Gmail or Outlook mailbox for booking confirmations, files the bookings it finds, and keeps the first 2,000 characters of each email it acted on so you can see why, along with any ticket or receipt attached to it, filed as a document on the trip. For an email that looked like a booking and wasn't added, it keeps the sender, the subject and when it arrived, and, if it was read as a booking, what the booking said and the first 2,000 characters, so you can see why it was left out and add it anyway. After 90 days that record is cleared down to your mailbox's id for the message, which says nothing about the email and only tells SirTripsALot it has already looked. Disconnecting doesn't clear these records; deleting your account does. It does not keep the rest of your mail, and it stops reading the moment you disconnect the mailbox. It also keeps a short list of emails that looked like bookings but weren't added, so you can add one yourself: the sender, the subject, when it arrived, and your mailbox's id for the message. It doesn't keep the email's text or attachments. Only the most recent 25 per mailbox are kept, and older ones drop off. When you tap Add it, SirTripsALot fetches that one email from your mailbox again and reads it like any other booking email. Disconnecting a mailbox deletes its list. If you forward an email to your SirTripsALot address instead, only that email is read.
• Documents you upload. Tickets, receipts, visas, and, in the vault, your passport, vaccination records and their photos. They are stored privately, in your own folder, and shown only to you through links that expire after two minutes. On the phone, opening one asks for Face ID or Touch ID; the check happens on the device and never reaches us.
• Where you are, while the app is open. Only if you allow it, and only to say how far you are from your next stop. Your location is used on the device and is not stored.
• A notification token. If you allow notifications, the phone gives us a token so we can tell you when an airline changes a flight. Nothing else is sent through it.
• Home airport, timezone and currency. Set by you, or inferred from your flights and shown to you as such.

What it does with that

Builds your itinerary, counts your days in Europe against the 90-in-180 rule, counts the countries you have been to, converts expenses, works out what your points bought, and checks your passport’s expiry against your booked trips. Every calculation runs for you and is shown to you. Nothing is sold, nothing is used for advertising, and nothing is used to train anything.

Who else sees it

• The services that run SirTripsALot. Supabase stores the data and handles sign-in; Vercel runs the site. Both hold it on SirTripsALot’s behalf and under its instructions.
• Parsing. The text of a booking confirmation — one you paste, one you forward, or one SirTripsALot finds in a connected mailbox — is sent to an AI model (Anthropic or OpenAI) to be turned into a structured booking. Only that email goes, never the rest of your mailbox, and neither provider may use it to train their models.
• Rates, weather, maps and flights. Exchange rates come from SirTripsALot's server, which asks free public rate services for them. Those requests carry only a currency and a date, nothing about you or your trip. Weather comes from Open-Meteo, maps from Mapbox or OpenStreetMap, and flight status from an aviation data provider. Those requests carry the place or the flight number, never your name or account.
• People you share with. If you share a trip by link, anyone holding the link sees the itinerary: what, when and where. Prices, booking references, other travelers and documents are not included. You can replace or stop the link at any time.
• Your mailbox provider. Connecting Gmail or Outlook goes through Google’s or Microsoft’s own consent screen, and you can revoke it there as well as in SirTripsALot.

Nobody else. There are no advertisers and no data brokers, and nothing follows you across other apps or sites.

Mail from Google and Microsoft

SirTripsALot's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The same rules apply to mail read from Microsoft Outlook.

• Mail is read with read-only access, only to find and file your bookings, and only for you.
• It is never sold, never used for advertising, and never used to train AI models, ours or anyone else's.
• It is shared only with the services named above, and only to do that job: the parsing model reads a booking email to file it, and the storage provider holds what was filed.
• Nobody at SirTripsALot reads your mail. The only exceptions are when you ask us to look at a specific email to fix a problem, when it is needed for security, or when the law requires it.
• Disconnecting a mailbox in SirTripsALot's Inbox deletes its access tokens and asks Google to revoke SirTripsALot's access. You can also remove it from your Google account or your Microsoft account.

How long it is kept

For as long as you have an account. Delete a booking, a document or a trip and it is gone from your account then; disconnect a mailbox and its sync tokens are deleted then. The one thing kept for less time is the record of emails SirTripsALot looked at and didn't add: after 90 days only the message's id is left. Backups held by the storage provider expire on their own schedule, measured in days.

Deleting your account

You can delete your account yourself, inside the app: on the web under Settings → Signing in, on the phone under Profile. Deleting removes your account, every trip and booking, every expense, every connected mailbox and every file you uploaded, at once and permanently. There is no waiting period and nothing to email us for.

Updates list

If you sign up for updates, SirTripsALot keeps your email address and when you confirmed it, and uses it only to tell you about SirTripsALot's availability and news. Every email has an unsubscribe link; unsubscribing stops them. To limit sign-ups from any one network, it also keeps a one-way code made from the network address and browser a sign-up came from, never the address itself. Signing up is not an account and does not give access to SirTripsALot.

Your choices

• Location, notifications, camera and photos are each a permission the phone asks for, and each can be refused or withdrawn in the phone’s Settings without losing anything else.
• Face ID for the vault and for the app itself are switches in Privacy, on the phone.
• A connected mailbox can be disconnected from the Inbox at any time, on the web or the phone.

Children

SirTripsALot is not for children under 13 and does not knowingly hold their data.

Changes

When this page changes, the date at the top changes with it. Anything that widens what is collected will be said on the sign-in page before it takes effect.

Contact

Questions about this policy, or a request we can act on for you: privacy@meridiantravelpro.com.